Tell HN: Scribd Breached

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Hacker News 新闻 | 往期 | 评论 | 提问 | 展示 | 招聘 | 提交登录 Tell HN：Scribd 遭入侵，由 x______________ 发布于 21 小时前，334 点 | 隐藏 | 往期 | 收藏 | 120 条评论。目前没看到任何地方发布相关消息，这是 2026 年 10 月 26 日星期一收到的通知：主题：安全事件通知。本通知由 Scribd, Inc.（Scribd、Slideshare、Everand 和 Fable 的母公司）的通知合作伙伴 Epiq 代为发送。

Hello,We are writing to let you know that Scribd, Inc. recently experienced a security incident that may have affected your data.We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history (not including credit card details).

您好，我们写信告知您，Scribd, Inc. 最近发生了一起可能影响您数据的安全事件。我们检测到未经授权的第三方可能访问了我们系统中的某些用户数据。经调查，我们发现该第三方可能访问了您的电子邮件地址以及以下信息：信用卡后 4 位及所属国家、信用卡发卡行、信用卡有效期、支付历史记录（不含信用卡详细信息）。

We have no evidence that this data has been misused, but we are notifying you out of an abundance of caution so that you can take steps to protect your information.Watch for phishingWe encourage you to stay vigilant for phishing attempts by bad actors pretending to be Scribd, Inc. or Scribd, Slideshare, Everand or Fable.

我们目前没有证据表明这些数据已被滥用，但出于谨慎考虑，我们通知您以便您采取措施保护个人信息。谨防网络钓鱼：我们鼓励您保持警惕，防范冒充 Scribd, Inc. 或 Scribd、Slideshare、Everand 或 Fable 的不法分子的钓鱼攻击。

Remember that Scribd, Inc. will never ask you for your username and password or other sensitive information via email or text. If you did receive a message like that: Don’t click on any links in it. Instead type scribd.com, slideshare.net, everand.com, or fable.co directly into your browser. Call us at: +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m., Central European Time. Report it through Scribd, Inc.’s Help Center.

请记住，Scribd, Inc. 绝不会通过电子邮件或短信向您索要用户名、密码或其他敏感信息。如果您收到此类信息，请勿点击其中的任何链接。请直接在浏览器中输入 scribd.com、slideshare.net、everand.com 或 fable.co。致电我们：+1-877-361-9887。工作时间为周一至周五，中欧时间上午 11:00 至晚上 11:00。请通过 Scribd, Inc. 的帮助中心进行举报。

For more informationWe regret that this incident occurred and any concern it may cause you. If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time.The National Cyber Security Center has helpful guidance on how to recognize and avoid phishing scams here.

更多信息：对于此次事件的发生以及可能给您带来的困扰，我们深表歉意。如有其他问题，请联系专用呼叫中心：+1-877-361-9887。工作时间为周一至周五，中欧时间上午 11:00 至晚上 11:00。国家网络安全中心在此提供了关于如何识别和避免网络钓鱼诈骗的实用指南。

What Scribd, Inc. is doing We have secured the affected system and ended the unauthorized access. We have notified law enforcement as well as the relevant data protection authorities. We are working with an expert third party cybersecurity firm to strengthen our access controls and monitoring. We value the trust you place in us with your information, and don’t take that lightly. We are deeply sorry this happened and will keep you updated if anything further changes.

Scribd, Inc. 的应对措施：我们已保护了受影响的系统并终止了未经授权的访问。我们已通知执法部门及相关数据保护机构。我们正与专业的第三方网络安全公司合作，以加强访问控制和监控。我们珍视您对我们的信任，绝不掉以轻心。对于此次事件我们深感抱歉，如有进一步变动，我们将随时通知您。

Buttons840 19 hours ago | next [–] I’d feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure, just to ensure it’s not too easy, but probably this isn’t happening because it would be a felony to even try. The bad guys are free to try though.

Buttons840 19 小时前 | 下一条 [–] 如果我知道有一些红队安全研究人员正在努力尝试攻破国家关键基础设施，以确保其安全性并非不堪一击，我会感觉好受得多。但这可能并没有发生，因为哪怕只是尝试都可能构成重罪。然而，坏人们却可以肆无忌惮地尝试。

All this will tend to get blamed on AI, but AI didn’t put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.

这一切往往会被归咎于人工智能，但人工智能并没有制造这些漏洞。人工智能只是一个可以用来发现漏洞的工具，我们唯一需要回答的问题是，普通人是否应该能够使用这个工具。

Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that’s not the question. This technology isn’t going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?

有些人会试图将问题定义为我们是否应该允许人工智能辅助网络安全，但问题不在于此。这项技术不会消失。坏人会拥有它，国家也会拥有它。再次强调，问题在于，普通人是否也能继续拥有它？

replyparable 17 hours ago | parent | next [–] As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It’s simply not worth the risk for most people - who aren’t in the USA - to bother doing this sort of security research.

回复 parable 17 小时前 | 父评论 | 下一条 [–] 作为几年前曾协助保护国家关键基础设施的人，我可以告诉你，披露我发现的漏洞是一团糟，有些漏洞甚至花了几年时间才修复。其中一些漏洞是远程代码执行（RCE）和大规模个人身份信息（PII）泄露。对于大多数不在美国的人来说，进行这类安全研究根本不值得冒这个险。

However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a…), so to the best of my understanding, you’re able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country’s infrastructure.

然而，如果你在美国，《计算机欺诈与滥用法案》（CFAA）中有相关条款允许进行善意安全研究。据我所知，你可以在不被指控或起诉的情况下进行善意研究，如果你有相应的技能或模型，应该利用这一点。我不在美国，我的国家没有任何法律能保证我仅仅因为做正确的事而免于牢狱之灾，所以我没有动力继续寻找我国基础设施中的漏洞。

Edit: If other countries don’t catch up and include similar provisions in their laws, they’ll simply fall behind and put their citizens at risk. I’m sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I’m sure, wouldn’t mind practicing their skills by securing their country’s infrastructure.

编辑：如果其他国家不跟进并在法律中加入类似条款，他们只会落后，并将公民置于风险之中。我相信每个国家都有愿意提供帮助但目前感到不安全的人——看看全球大量的漏洞赏金猎人，我相信他们不介意通过保护本国基础设施来磨练自己的技能。

replyButtons840 11 hours ago | root | parent | next [–] There was a guy in Missouri who pressed F12 (view source) and saw that the state website contained the SSN of all teacher—just right there in plain text in the HTML.He reported it responsibly and then the governor personally started attacking him and threatening him with a felony.

回复 Buttons840 11 小时前 | 根评论 | 父评论 | 下一条 [–] 密苏里州曾有一个人按了 F12（查看源代码），发现州政府网站包含了所有教师的社会安全号码（SSN）——就直接以纯文本形式写在 HTML 里。他负责任地报告了此事，结果州长亲自对他进行攻击，并威胁要以重罪起诉他。

I checked your link and I see that is a 2022 DoJ policy. How much peace of mind do you think a DoJ policy (not a law) from 2022 gives me?I read as far as the first sentence: “The policy for the first time directs that good-faith security research should not be charged.”Soooo… the underlying message here is that good-faith security research is technically against the law, but their policy is not to press charges. They clearly consider good-faith security research to be technically against the law, because it wouldn’t make sense to say “for the first time, our policy is to NOT charge people who follow the law”—that makes no sense. What they’re saying is “we could charge good-faith security researches, but let’s not as a matter of policy”.Reading further

我查看了你提供的链接，发现那是 2022 年司法部的一项政策。你认为一项 2022 年的司法部政策（而非法律）能给我带来多少安全感？我读到了第一句：“该政策首次指示不应对善意安全研究进行指控。”所以……这里隐含的信息是，善意安全研究在技术上是违法的，但他们的政策是不予起诉。他们显然认为善意安全研究在技术上是违法的，因为如果说“我们首次决定不对遵守法律的人进行指控”是毫无意义的。他们实际想说的是：“我们本可以起诉善意安全研究人员，但出于政策考虑，我们决定不这样做。”继续阅读。